CyberRota Analysis
AI-GeneratedGrav's Blueprint::dynamicData() function is vulnerable to arbitrary code execution due to improper validation of user-controlled callback parameters, allowing an authenticated user with admin privileges to execute commands on the web server. This high-severity vulnerability can lead to severe impacts, including unauthorized access and control over the server environment. Organizations using Grav versions prior to 2.0.7 should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.